Arbitrary Addition Creation Affecting json package, versions >=1.7.0, <1.7.7
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-JSON-20056
- published 3 Feb 2013
- disclosed 3 Feb 2013
- credit Steve Root
Overview
The json gem is a JSON implementation as a Ruby extension in C.
Affected versions of this gem contain a vulnerability in the JSON::GenericObject function which does not restrict users from creating additions, regardless of the state of create_additions. This may allow a remote attacker to create arbitrary additions.
CVSS Scores
version 3.1